:.:oropbox

Privacy and Data Protection
Introduction
Personal data plays a huge part in society and the economy. Increasingly, people are seeking greater control and clarity about how
their personal data is used and protected by organizations they interact with.
At Dropbox, trust is the foundation of our relationship with millions of people and businesses around the world. We value theconfidence you’ve put in us and take responsibility of protecting your personal data seriously.

Our Commitments to You
We’re committed to protecting yourpersonal data. Dropbox’s Terms ofService outline your responsibilities
when using our services. Our Privacy
Policy describes our privacy
commitments to users and explains
how we collect, use, and handle yourpersonal data when you use ourservices. If you reside in North
America (the United States, Canada,
and Mexico), Dropbox Inc. acts as
your service provider. For all otherusers, Dropbox International

Unlimited Company acts as acontroller of your personal data.

If you are a Dropbox Business or
Dropbox Education user, yourorganization acts as the data
controller for any personal data
provided to Dropbox in connection
with your use of Dropbox Business or
Dropbox Education. The data

Dropbox acts as the dataprocessor, processing data on
your organization’s behalf when
you use Dropbox Business or
Dropbox Education, and ourBusiness Agreement includes
commitments related to dataprocessing and international
data transfer.

Controller determines the purposes
and means of processing personaldata.

Our Track Record: Compliance
Compliance is an effective way tovalidate a service’s
trustworthiness. We encourage
and are pleased to provide
independent verification that our
security and privacy practices
comply with the most widely
accepted standards andregulations; such as ISO 27001,
ISO 27017, ISO 27018, ISO
27701, HIPPA / HITECH, and SOC
1, 2, and 3.

Furthermore, we were one of thefirst cloud service providers toachieve certification with ISO
27018, the internationallyrecognized standard for leading
practices in cloud privacy and dataprotection. Our independent thirdparty auditors test our controls andprovide their reports and opinions.
We may share these with you
whenever possible. Please note,
while the scope of our certifications

and audit reports typically refers to
Dropbox Business and Dropbox
Education, the majority of ourcontrols are applicable for Dropbox
Basic, Plus, and Professional
users as well. In addition, Dropbox
now adheres to the EU Cloud
Code of Conduct. More informationon the standards that we comply
with and how we verify ourpractices can be found on ourcompliance web page.

©2023 Dropbox. All rights reserved. V2023.08

:.: Dropbox

Dropbox Architecture: ProtectingYour Personal Data
At Dropbox, we believe protecting your personal data begins with keeping your data secure. To that end,
Dropbox is designed with multiple layers of protection, including secure file data transfer, encryption, andapplication-level controls that are distributed across a scalable, secure infrastructure.
Our Infrastructure: Files

Metadata Servers

Dropbox’s infrastructure for files is comprised of thecomponents depicted in the diagram below.

----•

Block Storage S.Nera~Stc,raps.rvic»•. • =ry~!·::~:~~..... 1ews .. ...,...

P

Pf..,._..Proce•sln&Servlce
P,.. _d1t1procesHd
intoenctypledchunks

■

■

• • 8

Hetadata

DatabaH■

Certain basic information about user data, called metadata, is kept in its
own discrete storage service and acts as an index for the data in users’
accounts. Metadata includes basic account and user information, likeemail address, name, and device names. Metadata also includes basic
information about files, including file names and types, that helps
support features like version history, recovery, and sync.

810CkSI01111<f~Filedata,torediner,crypte(lblocks

7

Metadata Databasesl==~;:~~""'""-•"""'"'"""''""'-""''"

File metadata is stored in a MySQL-based database service, and issharded and replicated as needed to meet performance and highavailability requirements.

namt&type)o-----~

Block Servers
By design, Dropbox provides a unique security mechanism that goesbeyond traditional encryption to protect user data. Block Servers
process files from the Dropbox applications by splitting each file into
blocks, encrypting each file block using a strong cipher, andsynchronizing only blocks that have been modified between revisions.
When a Dropbox application detects a new file or changes to an
existing file, the application notifies the Block Servers of the change,
and new or modified file blocks are processed and transferred to the
Storage Server.

Block Storage Servers
The actual contents of users’ files are stored in encrypted blocks with the Block Storage Servers. Prior to transmission, the Dropbox client splits files
into file blocks in preparation for the storage. The Block Storage Servers act as a Content-Addressable Storage (CAS) system, with each individual
encrypted file block retrieved based on its hash value.
Previews Servers
The Previews Servers are responsible for producing previews of files. Previews are a rendering of a user’s file in a different file format that is moresuited for fast display on an end user’s device. Previews Servers retrieve file blocks from the Block Storage Servers to generate previews. When a filepreview is requested, the Previews Servers retrieve the cached preview from the Previews Storage Servers and transfer it to the Block Servers.
Previews are ultimately served to users by Block Servers.
Preview Storage Servers
Cached previews are stored in an encrypted format in the Previews Storage Servers.
Notification Service
This separate service is dedicated to monitoring whether or not any changes have been made to Dropbox accounts. No files or metadata are
stored here or transferred. Each client establishes a long poll connection to the notification service and waits. When a change to a file in Dropbox
takes place, the notification service signals a change to the relevant client(s) by closing the long poll connection. Closing the connection signalsthat the client must connect to the Metadata Servers securely to synchronize changes.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper or contact sales@dropbox.com

:.:oropbox
Our Infrastructure: Paper
Dropbox Paper (Paper) is a feature of the Dropbox product. However, Paper uses a mostly distinct set of systems within the
Dropbox Infrastructure environment. Paper’s infrastructure is comprised of the components depicted in the diagram below.

Paper

Image

Storageserver•□ :=:s:1e.

·-~

Sl:orwNT\ill5uPloid«I

Prevt-starage

S.v••
•

-- ..
~ $t~

Hetadata

oatabaeee

Papw

Databa ...

□ ~r:::~.

•••P,-daiutoredl'I-..t~•(lud,----.....r•tlrneliHultlP•SSLHLS

Davloa■D. tJ (JPaper Application Servers
The Paper Application Servers process user requests, render the output of edited Paper docs back to the user, and perform
notification services. Paper Application Servers write inbound user edits to the Paper Databases, where they are placed in persistentstorage. Communication sessions between the Paper Application Servers and Paper Databases are encrypted using a strong cipher.
Paper Databases
The actual contents of users’ Paper docs, as well as certain metadata about these Paper docs, are encrypted in persistent storage on
the Paper Databases. This includes information about a Paper doc (such as the title, shared membership and permissions, project andfolder associations, and other information), as well as content within the Paper doc itself, including comments and tasks. The Paper
Databases are sharded and replicated as needed to meet performance and high availability requirements.
Paper Image Storage Servers
Images uploaded to Paper docs are stored and encrypted at rest on the Paper Image Servers. Transmission of image data between
the Paper Application and Paper Image Servers occurs over an encrypted session.
Previews Servers
The Previews Servers produce previews both for images uploaded to Paper docs, as well as hyperlinks embedded within Paper docs.
For images uploaded to Paper docs, the Previews Servers fetch image data stored in the Paper Image Storage Servers via an
encrypted channel. For hyperlinks embedded within Paper docs, Previews Servers fetch the image data and render a preview of theimage using encryption as specified by the source link. Previews are ultimately served to users by Block Servers.
Previews Storage Servers
Paper uses the same Preview Storage Servers described in the Dropbox infrastructure diagram to store cached image previews.
Cached preview chunks are stored in an encrypted format in the Previews Storage Servers.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper or contact sales@dropbox.com

:.:oropbox

Dropbox Controls: Our
Internal Practices
We take comprehensive measures to protect our infrastructure, network, andapplications. Some of the security measures we have in place include encryption at rest,
encryption in transit, and the permanent deletion of files. We also offer robust privacy
and security training for all our employees to build a culture where being worthy of trust
is a priority. Details of some of our controls are described below:
Training
Part of protecting our user’ personal
data involves building and growing aculture of security and privacy
awareness. Dropbox employees are
required to agree to security policies,
including a user data privacy policy,
prior to being granted systems
access. Only those employees with a
specific need have access to such
systems. Employees also take part inmandatory security and privacy
training on an annual basis.
Encryption in Transit
To protect file data in transit between
a Dropbox client (currently desktop,
mobile, API, or web) and Dropbox’s
front-end servers, an encrypted
connection is negotiated to ensure
secure delivery. Similarly, an
encrypted connection is negotiated toprotect Paper doc data in transit
between a Paper client (currently
mobile, API, or web) and the hosted
service. These connections are
encrypted using Secure Sockets
Layer (SSL)/Transport Layer Security(TLS) to create a secure tunnel
protected by 128-bit or higher
Advanced Encryption Standard (AES)
encryption.
Encryption at Rest
Files uploaded by users are stored
on Dropbox’s Storage Servers as
discrete file blocks. Each block is
encrypted using 256-bit Advanced

Only blocks that have been modified
between revisions are synchronized.
Similarly, Paper doc data stored on
Paper Databases is also encrypted at
rest using 256-bit Advanced
Encryption Standard (AES).
Permanent Deletion of Filesand Paper docs
When any Dropbox user or an
administrator for a Dropbox Businessor Dropbox Education team marks afile for permanent deletion, it triggers
a process to permanently delete thefile. Likewise, when a user, or an
administrator for a Dropbox Businessor Dropbox Education team marks aPaper doc for permanent deletion,
there is a similar process topermanently delete Paper doc dataand image data.
Personal Data Access
Requests
For access to personal data beyond
the files and Paper docs that are
stored with Dropbox, users can sign
in to the website and go to theiraccount pages. The account page willshow information like the name andemail address associated with theaccount. Users can also view the IP
addresses of connected sessions,computers, and mobile devices; aswell as apps connected to theiraccounts from the security page andconnected apps page.

Dropbox users also have theoption to request access to ordeletion of other personal datathat Dropbox may havecollected about them. Moreinformation about this process
can be found in the Dropbox
Help Center.
Privacy Governance at
Dropbox
The Privacy Team is responsible
for operating the Dropbox
Privacy Program. It implements
our key privacy initiatives andchampions privacy by design inour data lifecycle. The Dropbox
Privacy Program is further
supported by several crossfunctional Legal sub-teams.
These sub-teams provide theadditional expertise required tooperate and oversee the day-today tasks of the Privacy
Program.
The DPO team operates
separately from the other privacy
functions and serves as privacy
compliance and oversight directly
supporting the Data Protection
Officer in the execution of theirduties. The Data Protection
Officer (DPO) can be contacted at
privacy@dropbox.com.

Encryption Standard (AES).

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper or contact sales@dropbox.com

•••••Drop b ox
Government Data
Request Principles
We understand that when users
entrust us with their personal data,
they expect us to keep that data
confidential. Like most online services, Dropbox sometimes receives
requests from governments seeking
information about its users.
The principles below describe how
we handle the government data
requests we receive.
Be transparent
We believe online services should beallowed to publish the number andtypes of government requests theyreceive, and to notify individuals when
information about them has beenrequested. This type of transparency
empowers users by helping thembetter understand instances andpatterns of government overreach. We
will continue to publish detailed
information about these requests andadvocate for the right to provide moreof this important information.
Fight overly broad requests
Government data requests should be
limited in the information they seek
and narrowly tailored to specificpeople and legitimate investigations.
We will resist blanket and overly
broad requests.
Provide trusted services
Governments should never install
backdoors into online services orcompromise infrastructure to obtainuser data. We will continue to work toprotect our systems and to change
laws to make it clear that this type ofactivity is illegal.

Protect all users
Laws that give people different
protections based on where they
live or their citizenship are
antiquated and don’t reflect the
global nature of online services.
We will continue to advocate forthe reform of these laws.
These principles, along with
our annual transparency
report, are made publicly
available on the Dropbox
website at: https://www.
dropbox.com/transparency.
For additional details about
our controls and ourapproach to protecting yourpersonal data please refer toour Dropbox Business

Security Whitepaper.

Others Working for and with Dropbox
Dropbox manages the majority ofactivities related to the provision of
our services; however, we do utilize
some trusted third parties in relation to
our services (for example, providers ofcustomer support and IT services).
These third parties will only accessyour information to perform tasks on
our behalf in compliance with ourPrivacy Policy, and we’ll remain
responsible for their handling of yourinformation in accordance with our
instructions.

Each third party goes through a rigorous
vetting process, including security andprivacy reviews and regular contractual
reviews, to evaluate their ability to meet
our data protection commitments.
Based on this vetting process, Dropbox
affirms that its trusted third parties
commit to comply with applicable EU
Data Protection Law in connection withprocessing personal data on Dropbox’s
behalf. Customers can monitor
Dropbox’s trusted third parties byreviewing Dropbox’s ISO 27001 and

27018 certifications and, underappropriate obligations ofconfidentiality, reviewing Dropbox's
SOC 2 Type II report. In particular,
Customers can monitor Dropbox's
trusted third parties by examining
Dropbox's controls and audit resultsfor Trust Services Criteria P6.1,
P6.4, and CC.9.2 of the SOC 2 TypeII Report.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper or contact sales@dropbox.com

:.:oropbox

International Data Transfers
When transferring data from theEuropean Union, the European Economic
Area, the United Kingdom, andSwitzerland, Dropbox relies upon avariety of legal mechanisms, such as
contracts with our customers andaffiliates, Standard Contractual Clauses,
and the European Commission’s
adequacy decisions about certain
countries, as applicable.
Dropbox complies with the EU-U.S.
and Swiss-U.S. Data Privacy

Frameworks, as well as the UK
Extension to the EU-U.S. Data
Privacy Framework, as set forth by
the U.S. Department of Commerce
regarding the processing of personal
data transferred from the European
Union, the European Economic Area,
the United Kingdom, and Switzerland
to the United States. Dropbox has
certified to the U.S. Department ofCommerce that it adheres to these
Data Privacy Frameworks withrespect to such data, but this does

not include the DocSend or
Formswift portions of the Services.
To learn more about the Data
Privacy Framework, and to view
Dropbox’s certification, visit
www.dataprivacyframework.gov.
Complaints and disputes related to
our Data Privacy Frameworkcompliance are investigated andresolved through JAMS, an
independent third party. To learn
more, please see our Privacy Policy.

GDPR: The General Data Protection Regulation
The General Data Protection Regulation,
or GDPR, is an EU regulation thathave invested heavily in GDPR
compliance. The GDPR harmonizes datafor organizations that handle personaldata, as well as new rights for individuals

establishes a legal framework to protect
the personal data of EU data subjects.
The GDPR is the most significant piece ofEuropean data protection legislation
since the EU Data Protection Directive of
1995, and many companies—including
Dropbox—that do business in Europe

protection laws across Europe, andbrings them up to speed with the rapid
technological change that has occurred in
the past two decades. It builds upon pastlegal frameworks in the EU, including the
EU Data Protection Directive, andintroduces new obligations and liabilities

in respect of their personal data.
Organizations that are established in theEU, as well as organizations that process
personal data of EU data subjects, arerequired to comply with the GDPR.

Dropbox’s GDPR Compliance Journey
Dropbox is committed to GDPR
compliance. Respect for privacy andsecurity was built into our businessfrom the beginning, and as we’ve
grown, our focus on handling andprotecting the data that our users
entrust to us has remained a priority.
Dropbox has a track record of staying
ahead of the compliance curve — asdescribed above, we were one of thefirst cloud service providers toachieve ISO 27018 certification forour business users. Given this strong
foundation, Dropbox views GDPR
compliance as an evolution of ourexisting practices and controls, andrepresents an ongoing, evolving set
of initiatives to ensure that our users’

personal data is always protected.
Dropbox’s journey to GDPR
compliance began as soon as theregulation was adopted in 2016. Our
first step was to form a crossfunctional team of data protection
specialists consisting of legal counsel,
security and complianceprofessionals, and product andinfrastructure engineers. Our teamthen completed a full assessment ofour current security and dataprotection practices against the
GDPR requirements.
Our next step was to perform an
evaluation of our personal dataprocessing activities and trace thelifecycle of personal data through oursystems. These exercises are
sometimes referred to as performing
Data Mappings and completing Data
Protection Impact Assessments.
Since then, we have continued tobuild on our existing internal
processes and procedures to ensure
we meet the accountability principles
under the GDPR requirements,
including maintaining records ofprocessing in accordance with Article
30 of the GDPR. This is important as
the GDPR places an increased focus
on documenting decisions andpractices affecting personal data.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper or contact sales@dropbox.com

:.:oropbox

Empowering our Users on their GDPR Journeys
Dropbox provides control and visibility features that can help you manage your data protection obligations, including GDPR
compliance obligations, more easily. Of course, GDPR compliance across your organization does not begin or end with therelationship with your suppliers, such as Dropbox. While our features can help you manage your obligations, they cannot ensurecompliance in and of themselves. GDPR compliance requires thinking more broadly about how data moves around and is protectedin your organization. Each organization should undertake its own steps to reach compliance, with suppliers as important partners onthat journey.

Data Minimization
An important element of the GDPR’s
Privacy by Design requirement is thatorganizations should design theirservices in a data minimizing way.
This means having good visibility andcontrol of the data within yourorganization in order to help you
manage it. The Dropbox Businessadmin dashboard is a useful tool tohelp with this, as it enables you tomonitor team activity, view connected
devices, and audit sharing activity. We
work to embed the Privacy by Designprinciples into new products andfeatures.
Protection and Restorationof Data
Lost device protection, version
history, and file recovery can help
protect against accidental loss,
damage, or destruction of personaldata, and can help with the ability torestore availability and access topersonal data in a timely manner inthe event of an incident. Two-factor
authentication is another importantmeasure that we encourage to help
protect your data.

Record Keeping
The GDPR also increases obligations
on organizations to keep detailed
records of their processing activities.
Our audit logs and our activity logs
can help you better understand yourprocessing activities to support yourrecord keeping.
Access Administration
Within the Dropbox Business admin
dashboard, you easily manage teammember access to files, folders, andPaper docs. For shared file links, ourlink permissions feature allows you to
password protect the shared links, set
expiration dates to grant temporary
access, and limit access to thosewithin your organization. In the eventthat responsibilities change between
users, our account transfer tool allows
you to easily transfer files andownership of Paper docs from one
user to another.

your organization’s information
safe. Lastly, the remote wipefeature allows you to clear files
and Paper docs from lost or
stolen devices.
EU Infrastructure
While the GDPR does not
require personal data to behosted within the EU, Dropbox
does offer qualified Dropbox
Business and Dropbox
Education customers the ability
to store files (blocks) in the EU.
EU- based file storage isprovided on Amazon Web
Services (AWS) infrastructure.
To learn more about our EU
infrastructure, contact our sales
team.

Administrators also have the ability todisable a user’s access to theiraccount while preserving their dataand sharing relationships to keep

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper or contact sales@dropbox.com

:.:oropbox

Working Together to Protect Your Personal Data
Dropbox works with its users to protect
their personal data. We takecomprehensive measures to protect
our infrastructure, network, andapplications, train employees insecurity and privacy practices, build aculture where being worthy of trust is
the highest priority, andput our systems and practices throughrigorous third-party testing andauditing.
However, users also play a key role inprotecting their personal data.
Dropbox enables you to configure, use,
and monitor your account in ways thatprivacy, security, and complianceneeds. Our shared responsibility
guide can help you to understandmore about what we do to keep
your account safe and what you
can do to maintain visibility andcontrol over your personal data.

meet your organization’s

Summary
Every day, millions of users place their trust in Dropbox. To be worthy of that trust, we built and will continue to grow Dropbox with
an emphasis on security and privacy. Our commitment to protecting our users’ personal data is at the heart of each decision we
make. For more information, please email privacy@dropbox.com. For more information on GDPR, you can also visit our GDPR
guidance center.

For more detail on Dropbox security features and policies, please review the Dropbox Business Security Whitepaper or contact sales@dropbox.com